refactor(sdk/js): unify browser and node sources

after moving to @noble/hashes and @noble/curves the .browser.ts variants
were 95% identical to the node ones — only Buffer vs manual byte helpers
and \"import crypto\" vs globalThis.crypto. rewrite both subpaths to use
the universal pattern and drop the duplicates in the next commit.

- encrypt-env-vars.ts: drop \`import crypto from 'crypto'\` and use the
  global Web Crypto (works on Node 18+ and browsers)
- verify-env-encrypt-public-key.ts: drop Buffer (use manual hex / bigint
  helpers); make the function bodies stay synchronous like the previous
  node version, so the public signature does not change

both still return the same types and behave identically.

Author: Leechael

sdk/js/src/encrypt-env-vars.browser.ts

@@ -3,65 +3,63 @@
 // SPDX-License-Identifier: Apache-2.0
 
 import { x25519 } from "@noble/curves/ed25519"
-import crypto from 'crypto'
 
-// Convert hex string to Uint8Array
-function hexToUint8Array(hex: string) {
-  hex = hex.startsWith("0x") ? hex.slice(2) : hex;
+function hexToUint8Array(hex: string): Uint8Array {
+  hex = hex.startsWith("0x") ? hex.slice(2) : hex
   return new Uint8Array(
-    hex.match(/.{1,2}/g)?.map((byte: string) => parseInt(byte, 16)) ?? [],
-  );
+    hex.match(/.{1,2}/g)?.map((byte) => parseInt(byte, 16)) ?? [],
+  )
 }
 
-function uint8ArrayToHex(buffer: Uint8Array) {
+function uint8ArrayToHex(buffer: Uint8Array): string {
   return Array.from(buffer)
-    .map((byte: number) => byte.toString(16).padStart(2, "0"))
-    .join("");
+    .map((byte) => byte.toString(16).padStart(2, "0"))
+    .join("")
 }
 
 export interface EnvVar {
   key: string
   value: string
 }
 
-// Encrypt environment variables
-export async function encryptEnvVars(envs: EnvVar[], publicKeyHex: string) {
-  // Prepare environment data
-  const envsJson = JSON.stringify({ env: envs });
+/**
+ * ECIES-encrypt a set of environment variables against a recipient's x25519
+ * public key. Works on Node 18+ and modern browsers — uses `globalThis.crypto`
+ * (Web Crypto API) and @noble/curves.
+ */
+export async function encryptEnvVars(
+  envs: EnvVar[],
+  publicKeyHex: string,
+): Promise<string> {
+  const envsJson = JSON.stringify({ env: envs })
 
-  // Generate private key and derive public key
-  const privateKey = x25519.utils.randomPrivateKey();
-  const publicKey = x25519.getPublicKey(privateKey);
+  const privateKey = x25519.utils.randomPrivateKey()
+  const publicKey = x25519.getPublicKey(privateKey)
 
-  // Generate shared key
-  const remotePubkey = hexToUint8Array(publicKeyHex);
-  const shared = x25519.getSharedSecret(privateKey, remotePubkey);
+  const remotePubkey = hexToUint8Array(publicKeyHex)
+  const shared = x25519.getSharedSecret(privateKey, remotePubkey)
 
-  // Import shared key for AES-GCM
   const importedShared = await crypto.subtle.importKey(
     "raw",
     new Uint8Array(shared),
     { name: "AES-GCM", length: 256 },
     true,
     ["encrypt"],
-  );
+  )
 
-  // Encrypt the data
-  const iv = crypto.getRandomValues(new Uint8Array(12));
+  const iv = crypto.getRandomValues(new Uint8Array(12))
   const encrypted = await crypto.subtle.encrypt(
     { name: "AES-GCM", iv },
     importedShared,
     new TextEncoder().encode(envsJson),
-  );
+  )
 
-  // Combine all components
   const result = new Uint8Array(
     publicKey.length + iv.length + encrypted.byteLength,
-  );
+  )
+  result.set(publicKey)
+  result.set(iv, publicKey.length)
+  result.set(new Uint8Array(encrypted), publicKey.length + iv.length)
 
-  result.set(publicKey);
-  result.set(iv, publicKey.length);
-  result.set(new Uint8Array(encrypted), publicKey.length + iv.length);
-
-  return uint8ArrayToHex(result);
+  return uint8ArrayToHex(result)
 }